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THE CLAIMS 

For the convenience of the Examiner, all pending claims of the present Application 
are shown below whether or not an amendment has been made. 

1. (Currently Amended) A method of identifying problems in applications, 
comprising: 

monitoring at a kernel level system resource usage of one or more running 
applications without modifying run-time environments of the one or more applications; 

determining a system resource usage pattern of a first application, the system resource 
usage pattern indicating a change in the system usage of the first applicatio n from a first time 
period to a second time period; 

from the monitored system usage, determining whether a the system resource u sage 
pattern of a the first application satisfies a predetermined criteria associated with one or more 
problems; and 

if the system resource usage pattern of the first application satisfies the predetermined 
criteria, identifying the first application to a user. 

2. (Currently Amended) The method of claim 1, wherein the system resource 
usage comprises a number of the one or more processes that each of the one or more 
applications have spawned and the predetermined criteria comprises exceeding a 
predetermined limit on the number of processes that each of the one or more applications 
may spawn. 

3. (Currently Amended) The method of claim 1, wherein: 

monitoring at a kernel level system resource usage of one or more running 
applications comprises monitoring a parent-child relationship between one or more running 
processes and each of the one or more applications; and 

determining whether a the system usage pattern of a the first application satisfies a 
predetermined criteria associated with one or more problems comprises determining whether 
the first application has orphaned one of the one or more running processes. 
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4. (Previously Presented) The method of claim 1, wherein the system resource 
usage comprises memory usage of the one or more running applications. 

5. (Previously Presented) The method of claim 1 , wherein: 

the one or more applications comprise one or more user applications initiated at the 
user level; and 

monitoring at a kernel level system resource usage of one or more running 
applications comprises monitoring at a kernel level system resource usage of one or more 
running processes belonging to one or more user applications wherein the one or more 
running processes comprise one or more processes initiated at the kernel level by the one or 
more user applications. 

6. (Previously Presented) The method of claim 1 wherein the system resource 
usage of the one or more running applications is monitored over a plurality of consecutive 
discrete time periods. 

7. (Previously Presented) The method of claim 6, wherein: 

the system resource usage comprises an amount of memory usage for each of the one 
or more applications; and 

the predetermined criteria is a limit on a number of memory increases allowed during 
the plurality of time periods. 

8. (Previously Presented) The method of claim 6, wherein: 

the system resource usage comprises an amount of memory usage for each of the one 
or more applications; and 

the predetermined criteria is a generally continuous increase in the amount of memory 
usage during the plurality of time periods. 

9. (Previously Presented) The method of claim 6, wherein: 

the system resource usage comprises a number of processes that each of the one or 
more applications have spawned; and 
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the predetermined criteria is a generally continuous increase in the number of child 
processes spawned during the plurality of time periods. 

10. (Previously Presented) The method of claim 1, wherein identifying the first 
application to a user comprises saving an identifier of the first application in a reference file, 
and further comprising saving identifiers of any other of the one or more applications whose 
system usage pattern satisfies a predetermined criteria associated with one or more problems 
in the reference file. 

11. (Previously Presented) The method of claim 10, wherein a computer 
automatically: 

monitors the kernel level system resource usage of one or more running applications; 
determines whether a system usage pattern of a first application satisfies a 
predetermined criteria associated with one or more problems; and 
identifies the first application. 
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12. (Currently amended) A method of identifying memory problems in 
applications, comprising: 

monitoring at a kernel level memory usage of one or more running applications 
without modifying run-time environment of the applications; and 

producing an output comprising at least the memory usage; and 

determining a memory usage pattern of a first application, the memory usage pattern 
indicating a change in the memory usage of the first application from a firs t time period to a 
second time period; 

from the monitored memory usage, determining whether a the memory usage pattern 
of a the first application satisfies a predetermined criteria associated with one or more 
problems; and 

if the memory usage pattern of the first application satisfies the predetermined 
criteria, identifying the first application to a user. 

13. (Previously Presented) The method of claim 12, wherein: 

the memory usage of the one or more running processes is monitored over a plurality 
of consecutive discrete time periods, and 

the predetermined criteria is a limit on a number of memory increases allowed during 
the plurality of time periods. 
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14. (Currently Amended) A system for identifying memory problems in 
applications, comprising a computer operable to: 

monitor at a kernel level memory usage of one or more running applications without 
modifying run-time environments of the one or more applications; 

produce an output comprising at least the memory usage of one or more applications; 

determining a memory usage pattern of a first application, the memory usage pattern 
indicating a change in the memory usage of the first application from a first time p eriod to a 
second time period; 

from the output, determine whether a the memory usage pattern of a the first 
application satisfies a predetermined criteria associated with one or more problems; and 

if the memory usage pattern of the first application satisfies the predetermined 
criteria, identify the first application by saving an identifier of the first application in a 
reference file. 
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15. (Currently Amended) A method of identifying memory problems in 
applications, comprising: 

monitoring at a kernel level memory usage of one or more running 
applications without modifying run-time environments of the running applications; 

determining a memory usage pattern of a first application, the memory usage 
pattern indicating a change in the memory usage of the first application from a first time 
period to a second time period; 

from the monitored memory usage, determining whether a the memory usage 
pattern of a the first application satisfies a predetermined criteria associated with one or more 
problems; and 

if the memory usage pattern of the first application satisfies the predetermined 
criteria, identifying the first running application without identifying the one or more running 
applications whose memory usage patterns do not satisfy the predetermined criteria 
associated with the one or more memory problems. 

16. (Original) The method of claim 15, wherein the monitored memory usage 
comprises at least a stack memory, data memory, and text memory. 
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17. (Currently Amended) A method of identifying memory problems in 
applications, comprising: 

collecting system resource usage at a kernel level of one or more running 
processes belonging to one or more applications without modifying run-time environments of 
the one or more user running applications; and 

determining a system resource usage pattern of a first application, the system 
resource usage pattern indicating a change in the system resource usage of the first 
application from a first time period to a second time period; 

from the collected system resource usage, determining whether a the system 
resource usage pattern of a the first application satisfies a predetermined criteria associated 
with one or more problems; and 

if the system resource usage pattern of the first application satisfies the 
predetermined criteria, identifying the first application to a user. 
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18. (Currently Amended) A system for identifying problems in applications, 
comprising: 

a data collection module operable to retrieve information about a running user 
applications at a kernel level; and 

a data analysis module operable te to: 

determine from the retriev e d information an abnormal system usage pattern in 
the information; and 

identify from the abnormal s ystem u s age pattern, a first user application whose 
system usage pattern satisfies a predetermined criteria associated with one or more probl e ms 
problems, the system usage pattern of the first user application indicating a cha nge in the 
system usage of the first application from a first time period to a second time . 
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19. (Currently Amended) A program storage device readable by a machine, 
tangibly embodying a program of instructions executable by the machine to perform method 
steps of identifying problems in applications, comprising: 

monitoring at a kernel level system resource usage of one or more running 
applications without modifying run-time environments of the one or more applications; 

determining a system usage pattern of a first application, the system usage pattern 
indicating a change in the system usage of the first application from a firs t time period to a 
second time period; 

from the monitored sy s tem usage, determining whether a the system resource usage 
pattern of a the first application satisfies a predetermined criteria associated with one or more 
problems; and 

if the system resource usage pattern of the first application satisfies the predetermined 
criteria, identifying the first application to a user. 

20. (Previously Presented) The program storage device of claim 19, wherein the 
system resource usage comprises a parent-child relationship between one or more processes 
and each of the one or more applications; and 

determining whether a system usage pattern of a first application satisfies a 
predetermined criteria associated with one or more problems comprises determining whether 
the first application has orphaned one of the one or more running processes. 

21. (Previously Presented) The method of Claim 1, wherein determining whether 
a system usage pattern of a first application satisfies a predetermined criteria associated with 
one or more problems comprises: 

comparing the monitored system usage for the first application against the 
predetermined criteria; and 

selecting the first application from the one or more running applications if the system 
usage pattern of the first application satisfies the predetermined criteria. 
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